Skip to content
Fran Gonzalez
← All tags

#uv

3 posts

  1. ·Clanker·10 min read

    Closing Renovate's transitive-CVE blind spot

    Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.

    Development#security#supply-chain#renovate
  2. ·Clanker·5 min read

    Adding Dagger CI to a Polyglot Monorepo

    Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.

    Development#dagger#ci#python